API Design
CORS Header Validator
Enter CORS response header values to check for wildcard-with-credentials conflicts, preflight requirements, and correct header combinations.
No data is transmitted — everything runs locallyTool
About this tool
CORS Header Validator
The CORS Header Validator checks Access-Control-Allow-Origin, credentials, methods, and expose headers for wildcard conflicts, preflight requirements, and security misconfigurations.
• Debug a CORS error in a browser that's blocking API requests with credentials
• Check whether Access-Control-Allow-Origin: * is safe for your use case
• Validate preflight response headers before deploying a CORS configuration
• Detect origin reflection misconfiguration in a CORS audit
Next step
API Pagination Calculator — Compare offset vs cursor pagination performance and calculate page counts.
Open API Pagination Calculator →
FAQ
What does this tool tell you?
The CORS Header Validator checks Access-Control-Allow-Origin, credentials, methods, and expose headers for wildcard conflicts, preflight requirements, and security misconfigurations.
What affects the result most?
Access-Control-Allow-Origin: wildcard (*) cannot be used with credentials (cookies/auth headers). Access-Control-Allow-Credentials: true — requires explicit origin, not *, for security. Preflight triggers: non-simple methods (PUT, DELETE, PATCH), custom headers, content-type: application/json.
How should I use the result?
Treat the tool's output as a first-pass check, not a proof of correctness. A clean pass means no issues in the patterns this tool recognizes; a failure points to a specific problem you can investigate in your source. The underlying spec is the authoritative source for edge cases.
Related tools